PT-2019-7913 · Envato · Web File Explorer

Published 2019-05-09 · Updated 2019-05-10 · CVE-2017-12761

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebFile Explorer version 1.0

Description The issue allows for Arbitrary File Download remotely. It is related to a SQL Injection vulnerability. The component download.php is affected, specifically the variable $file = $ GET['id']. The attack vector is through the endpoint "http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php".

Recommendations For WebFile Explorer version 1.0, consider restricting access to the download.php component to minimize the risk of exploitation. Avoid using the id variable in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-12761

Affected Products

Web File Explorer

References · 6

• 🔥 https://exploit-db.com/exploits/42440 · Exploit
• https://osv.dev/vulnerability/CVE-2017-12761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12761 · Security Note
• http://codecanyon.net/user/Endober · Note
• http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php · Note
• http://webfile.com · Note